@opengeni/worker-bundle 2.0.0 → 2.0.1

package/dist/index.js

@@ -785,7 +785,7 @@ function temporalWorkflowExecutionNotFound(error) {
   return isGrpcServiceError(error) && error.code === 5;
 }
 async function createDefaultWorkerActivities(role, dependencies = {}) {
-  return role === "control" ? (await import("./activities-control-BOLIY3H4.js")).createControlActivities(dependencies) : (await import("./activities-turn-2B3WMHBB.js")).createTurnActivities(dependencies);
+  return role === "control" ? (await import("./activities-control-QA6OLRQY.js")).createControlActivities(dependencies) : (await import("./activities-turn-YVVKCGAK.js")).createTurnActivities(dependencies);
 }
 function resolveOpenGeniWorkflowDefinition(moduleUrl = import.meta.url) {
   const modulePath = fileURLToPath(moduleUrl).replaceAll("\\", "/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -56,21 +56,21 @@
     "@llamaindex/liteparse": "2.14.2",
     "@opengeni/agent-proto": "^0.6.0",
     "@opengeni/capabilities": "^0.3.4",
-    "@opengeni/codemode": "^0.6.0",
-    "@opengeni/codex": "^0.2.24",
-    "@opengeni/config": "^2.0.0",
-    "@opengeni/contracts": "^5.0.0",
-    "@opengeni/core": "^4.0.0",
-    "@opengeni/db": "^6.0.0",
-    "@opengeni/documents": "^0.8.31",
-    "@opengeni/events": "^0.4.29",
-    "@opengeni/github": "^0.7.14",
+    "@opengeni/codemode": "^0.6.1",
+    "@opengeni/codex": "^0.2.25",
+    "@opengeni/config": "^2.1.0",
+    "@opengeni/contracts": "^5.1.0",
+    "@opengeni/core": "^4.0.1",
+    "@opengeni/db": "^6.0.1",
+    "@opengeni/documents": "^0.8.32",
+    "@opengeni/events": "^0.4.30",
+    "@opengeni/github": "^0.7.15",
     "@opengeni/network": "^0.3.1",
-    "@opengeni/observability": "^0.8.30",
-    "@opengeni/runtime": "^4.0.0",
-    "@opengeni/sdk": "^7.0.0",
-    "@opengeni/storage": "^0.2.131",
-    "@opengeni/tool-gateway": "^0.1.11",
+    "@opengeni/observability": "^0.8.31",
+    "@opengeni/runtime": "^4.0.1",
+    "@opengeni/sdk": "^7.1.0",
+    "@opengeni/storage": "^0.2.132",
+    "@opengeni/tool-gateway": "^0.1.12",
     "@opengeni/xai-subscription": "^0.1.4",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",

package/src/activities/agent-turn/agent-build.ts

@@ -79,6 +79,7 @@ import { resolveVideoReferenceSandboxAccess } from "./video-reference-sandbox";
 
 export type BuildTurnAgentDeps = {
   skillCatalog: NonNullable<BuildAgentOptions["skillCatalog"]>;
+  mcpServers: Settings["mcpServers"];
   input: RunAgentTurnInput;
   db: ActivityServices["db"];
   runtime: ActivityServices["runtime"];
@@ -139,6 +140,7 @@ export type BuildTurnAgentDeps = {
 
 export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
   const {
+    mcpServers,
     input,
     db,
     runtime,
@@ -621,7 +623,9 @@ export async function buildTurnAgent(deps: BuildTurnAgentDeps) {
     const agentConstructionStartedAt = performance.now();
     let agentConstructionOutcome: "completed" | "failed" = "completed";
     try {
-      return runtime.buildAgent(eventing.modelRunSettings, runtimeResources, {
+      // Approval policy must use the same accepted account identities as tool
+      // preparation. Keep the separately resolved model/sandbox settings intact.
+      return runtime.buildAgent({ ...eventing.modelRunSettings, mcpServers }, runtimeResources, {
         ...(linkedToolAuthority
           ? {
               authorizeAttemptExecution: async () => {

package/src/activities/agent-turn/claim.ts

@@ -19,6 +19,7 @@ import { linkCurrentSpanToAdmission, turnExecutionTelemetryKey } from "@opengeni
 import { deliverChildRequiresActionToParent } from "../parent-wake";
 import {
   assertTurnExecutionPolicyMatchesConfigV1,
+  settingsForAcceptedSubscriptionTurn,
   resolveTurnExecutionPolicyV1,
   type Settings,
 } from "@opengeni/config";
@@ -277,7 +278,7 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     gatewaySettings,
     claimedPolicy.kind === "valid" ? claimedPolicy.policy.productModelId : turn.model,
   );
-  const capabilitySettings = await settingsWithOrganizationProviderCredentials(
+  let capabilitySettings = await settingsWithOrganizationProviderCredentials(
     db,
     input.accountId,
     input.workspaceId,
@@ -287,7 +288,6 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   const codexAppsCredentialId = capabilitySettings.codexConnectedAppsEnabled
     ? await resolveCodexAppsCredentialIdForRun(db, input.workspaceId)
     : null;
-  runtime.configure(capabilitySettings);
   const policyForAbsent =
     claimedPolicy.kind === "valid"
       ? claimedPolicy.policy
@@ -304,6 +304,16 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   if (!installedPolicy.accepted) {
     throw new TurnAttemptFencedError(`turn execution policy was fenced: ${installedPolicy.reason}`);
   }
+  capabilitySettings = settingsForAcceptedSubscriptionTurn(
+    capabilitySettings,
+    installedPolicy.policy,
+    {
+      modelId: turn.model,
+      reasoningEffort: turn.reasoningEffort,
+      latencyMode: turn.latencyMode,
+    },
+  );
+  runtime.configure(capabilitySettings);
   const verifiedExecutionPolicy = assertTurnExecutionPolicyMatchesConfigV1(
     capabilitySettings,
     installedPolicy.policy,

package/src/activities/agent-turn/run.ts

@@ -1302,6 +1302,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
 
           const builtAgent = await buildTurnAgent({
             skillCatalog: toolRuntime.skillCatalog,
+            mcpServers: toolRuntime.mcpServers,
             input,
             db,
             runtime,

package/src/activities/agent-turn/stream-attempt.ts

@@ -17,6 +17,7 @@ import { publishDurableSessionEvents } from "@opengeni/events";
 import {
   normalizeModelCallUsage,
   normalizeSdkEvent,
+  withMcpToolDisplayMetadata,
   extractOpenSuffixFromRunState,
   assertOpenSuffixResumable,
   interruptionKindForCallItem,
@@ -1304,6 +1305,11 @@ export async function runTurnStreamAttempt(
               : {},
           );
         for (const event of normalized) {
+          if (event.type === "agent.toolCall.created")
+            event.payload = withMcpToolDisplayMetadata(
+              eventing.preparedTools?.mcpServers ?? [],
+              event.payload,
+            );
           streamTiming.onEvent(event.type);
           await eventing.batcher.push(event);
         }
@@ -1641,7 +1647,14 @@ export async function runTurnStreamAttempt(
               ? [
                   {
                     type: "session.requiresAction" as const,
-                    payload: { approvals },
+                    payload: {
+                      approvals: approvals.map((approval) =>
+                        withMcpToolDisplayMetadata(
+                          eventing.preparedTools?.mcpServers ?? [],
+                          approval,
+                        ),
+                      ),
+                    },
                   },
                 ]
               : []),

package/src/activities/agent-turn/tool-environment.ts

@@ -31,6 +31,7 @@ import {
   type ConnectorAttachmentMaterializationRequest,
   type ConnectorActionPolicyHooks,
   createFirstPartyInteractionAttemptToolDefinitions,
+  mcpToolDisplayMetadata,
 } from "@opengeni/runtime";
 import {
   createGoogleDrivePublicationAttemptTool,
@@ -1095,6 +1096,9 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
         executionGeneration: attempt.executionGeneration,
       },
       cancellationSignal,
+      undefined,
+      {},
+      (name) => mcpToolDisplayMetadata(tools.mcpServers, name),
     );
     eventing.codemodeDispatcher.start();
   };
@@ -1113,6 +1117,7 @@ export async function prepareTurnToolRuntime(deps: PrepareTurnToolRuntimeDeps) {
   return {
     attemptConnectorActionBindings,
     connectorActionPolicy,
+    mcpServers: runSettings.mcpServers,
     generateSessionTitleInParallel: titleToolPlan.generateTitleInParallel,
     postToolPreparationStartedAt,
     preparationIndependentToolNames: [

package/src/activities/codemode-dispatcher.ts

@@ -16,6 +16,7 @@ import {
   CODEMODE_MAX_CONCURRENT_CALLS_PER_ATTEMPT,
   type CodemodeOperation,
   type SessionEvent,
+  type ToolDisplayMetadata,
 } from "@opengeni/contracts";
 import {
   cancelQueuedCodemodeOperationsForAttempt,
@@ -70,6 +71,7 @@ export class CodemodeAttemptDispatcher {
     private readonly turnSignal?: AbortSignal,
     private readonly maxConcurrentCalls = CODEMODE_MAX_CONCURRENT_CALLS_PER_ATTEMPT,
     timings: CodemodeDispatcherTimings = {},
+    private readonly toolDisplayMetadata?: (modelName: string) => ToolDisplayMetadata | undefined,
   ) {
     if (
       environment.catalog.accountId !== scope.accountId ||
@@ -371,6 +373,10 @@ export class CodemodeAttemptDispatcher {
             payload: {
               id: operation.operationId,
               name: entry.modelName,
+              display: this.toolDisplayMetadata?.(entry.modelName) ?? {
+                toolName: entry.identity.toolName,
+                ...(entry.title ? { title: entry.title } : {}),
+              },
               arguments: operation.arguments,
               origin: "codemode",
               subjectId: operation.caller.subjectId,

package/src/sandbox-routing.ts

@@ -787,11 +787,15 @@ function adoptRetainedProcessAsBackgroundCommandForTurn(
   services: RoutingWiringServices,
   ids: RoutingWiringIds,
 ):
-  | ((input: { backend: ResolvedActiveBackend; process: RoutingRetainedProcess }) => Promise<void>)
+  | ((input: {
+      backend: ResolvedActiveBackend;
+      process: RoutingRetainedProcess;
+      command?: string | undefined;
+    }) => Promise<void>)
   | undefined {
   const fence = ids.workspaceMutationFence;
   if (!fence) return undefined;
-  return async ({ backend, process }) => {
+  return async ({ backend, process, command }) => {
     const durable = await getRetainedProcess(services.db, {
       workspaceId: ids.workspaceId,
       sessionId: ids.sessionId,
@@ -818,7 +822,7 @@ function adoptRetainedProcessAsBackgroundCommandForTurn(
       attemptId: fence.attemptId,
       processId: process.id,
       expected: retainedProcessSettlementIdentity(durable),
-      command: "execCommand",
+      command: command ?? "Background command",
     });
   };
 }